�5���SI�4ER���>Ol�8<6�8��M�/�w�\�d3�����K�_��J_��a�����N�t;3!��"��Mx�4�O��m�Ļ��Y��[!�H�i�0*b�*���Qll��xUȨA1���͵�:��9��'� f�>$/�ܱ,���0��U SS��F�ĔD�����U,�q��uwQ�sÑON���Ɩ��l a������ 䊮��g�%�����d骏�L�q�Fy��L���q9vmQ�ܼ@g�3*�4��ͤDvUQ}����ϥ�9�Lx��TL��ه�h��M���K��kf.�v�7M��KK��d�������O�3(����&��+X�Ֆm���X�/���o����|<����P���O�D˥�JO�(D��>d�~%;��c��"�H{�[�;�c/�� �/(�U�;��\��?/L5�<�kܰ�A�}<��\���c3j�b@(}�3Q�Z||�+���Hj��Lgm��� ���x�M�B�5��.����9� ��%l����<:���#l\%�q�Pn�B!���ݿ���.]N�(O�2��44^�*��Ӿ���:��,�}�=���B�1bX`1-�>&�M����i]w6w)�����M�o�P��_qH C��/~��ŤSgR�?=λ䅾IMa@G��8�j�ʂ�k���!'��Z��'����a��aG��Ե�:� u��Ŕ���IX��XV�RYP�d�x�;�J{�~�RSu'����q�Ӑ@!���*E����O��"%�]G�ݮ�U�X�5�"\xR �<`�����n���,�6�e������D����4ʠ?���u��:�H�F��x�� �%�1��3�Ҫ*D�r��OTl�[X� H �v��v��| W[v�kܸV���x�z��_){��'��1��<a^ΟWtO�i� D.�&�U ��^�o��K��,V��hk���PK���dw��y���):�{�#Eɴ���� D������^Nh��ւ}�� � �]J�=���JV�m�r@����y���4?��;7g���=����((̨p�E���ȍ�;��Y�1gxa�I�Q��q̢5�^vd իۊ��l7��)�]���ֈ�e&c����VX^w�!,ˋ��{�'g�B`�p�T�M ���wĀ���W -n�����������0�3�`��~�k�>��Җ�=0�#Hz��k_Bv7q/pq]���Ѩ���C��\й��2�O�,E� ��WVA�Y�%�JN���X� ���7!����t��#�.�K�G)�.Gȱ�S`�&TyZQ���5Y�F�>��� ��#ߦh���).�u��� ��u֔�a%��H§R[��"dWp?�5���88�Q%��h&���`�ij-墩z�p���G�-~i�2�8��r�=2�T����1&m�^o�ԙ�����Rl��MmG��@���m����K7l�&'�;ۮM�f=����K�� r8m(��G�|fh���`�]=�S}=��t���$����z����c�\{�6.��R'9�n7��F��2�W���d�*j���U��8��.H�g��5��3�SR�6�|�G7��F�֔�ɹ�����7s�M�<�\D �Ȯ?���+����P2�6�ːأ#���V�),:��i�q��_�c��U���މ͢����v*c*C��)W���z�v�� �v�Z��o��7��X������ L7C���ϩ����B�}�+�>M�S��.!���)W ��3����@��"Z����.��~n����^_�ڇ*�c %e��7���d��v�c�4�<;���2���.z`M�;Ҹ�v�7iL���kß��0Cܩ~��� E����+��-����5K`�w��^?F�Y��;Xa�� �]�r[fѹ���)}�W���#_�:2f� ���,�i�=KډȆakP�nLpMx>b��i]���W`�3d-ѩ ���mbgU�����Y���&H��u�3�ˉ9p �X[�~d�^ߊ$��YF�S14����iJA�f�~�D!M[��y���m�ATD hWFA���|�@�.������j4SK��䟓A�Wn3�(����Z��l��lu�����>G1����@Q�@��Y|�g��b����.N�{(�.N�������g{&Y.�uU�OS�'L�t�Er=-�]�-�i����:Ef�Cb����D��<dYoǬ�JW��{z֨W�"�L�g�$f�5%�k������N�&�^��S�(�b�5\�'�����Sw�{,��{q-� &�r��.�{yW �W�����A� �F�������R|s�C�{�b�R!ZHT�S�X(��CGO�M[��j�7�H]_v�����g������S��&`y~ r���ȵS/#ǭ���D��@����i]���� �����P�W���'���A���Q�-"q�H�讆����J�G����̀t���mi�}"��u���ϥ��G��m_�M:���:ο-۲-�y҆��4~���q�5��l��A�v��UJ�2��U9Ns�<rt?��K�Z�z���'�%�d�3�9U`�Kƻ�S@W.�C:B{�/UJ��ug0PE��%�P�ɦ@��au����X��]��͍�h�}!���ŌH������*O{HPL�����OO����Q�I�� ���V�p�Ҋ> �Bt��gK�(�dԖȷ�Z�z!e ��qx���{���hڃ ���BH4|�=9f��ذA$,Q�{�Q���C'#ɓ���|�J��[�а�cж�`�G}Lu�p�(��ĥ��B�E��:,�ӽ�/��F()�O���_co(������q��&��O0�(��$�\o��!�rd����dft���6S2aZ<*�_g�~Ȧ�V�b��NjhU���Y�=N�U��#m�����b�c�4'� ��E���6ӂ�Z�����]�a%��b��U��aQ�u�1b�eg��3�� �$���Tϕ����j1A0"*�H��8�aAԻ�B�,��8���N&����!Ez�qj���&��k�R���Ê :u|�e�*m�:P6'W�3ɪ�*ҹ�T��H�2��te
Static task
static1
Behavioral task
behavioral1
Sample
497416ea5d4118ebccc5087711a9cd72_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
497416ea5d4118ebccc5087711a9cd72_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
497416ea5d4118ebccc5087711a9cd72_JaffaCakes118
-
Size
235KB
-
MD5
497416ea5d4118ebccc5087711a9cd72
-
SHA1
043334562d0c8e05d47f0741e1a32283aecb3b97
-
SHA256
734881c3c24ab9eec396094626ffc11e0053a4f2a9f15a7f9aeca8ab46023f7e
-
SHA512
1183fb86d4e84b8bef897fabbd00ac0bbcf37d31c8b29f32cc225c705bba8e6052308080c3fea801c930504eab3310dc264cb78ac7d222c018c28fd26ca2e6ad
-
SSDEEP
6144:nthp/GDERluzjbJV9p8EPPm5cdZO143OuNQxCMtXHVMe:ntj+DE8jVV9p8yPndm4+waCMLMe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 497416ea5d4118ebccc5087711a9cd72_JaffaCakes118
Files
-
497416ea5d4118ebccc5087711a9cd72_JaffaCakes118.exe windows:5 windows x86 arch:x86
7790f0028006f3e155454712554614d4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
GetOpenFileNameW
shell32
DragQueryFileW
winspool.drv
ClosePrinter
comctl32
CreateStatusWindowW
msvcrt
_cexit
advapi32
RegOpenKeyExA
kernel32
GetACP
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
gdi32
DeleteDC
user32
CharUpperW
Exports
Exports
Sections
.text Size: - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.box0 Size: - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.box1 Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE